Microsoft-Windows-WebIO

156 events across 2 channels

Event	Title	Channel	Sample
1	ApiObject: WebInitialize completed successfully (ApiVersion ApiVersion) (Flags …	Diagnostic	N
2	WebInitialize failed with an error = Error (ApiVersion ApiVersion) (Flags …	Diagnostic	N
3	ApiObject WebTerminate completed successfully.	Diagnostic	N
4	ApiObject WebTerminate failed with an error = Error.	Diagnostic	N
5	Session: WebCreateSession completed successfully.	Diagnostic	N
6	ApiObject: WebCreateSession failed with an error = Error.	Diagnostic	N
7	ApiObject: WebCloseSession called (Handle ApiHandle) (Flags Flags).	Diagnostic	N
8	ApiObject: WebCloseSession failed with an error = Error.	Diagnostic	N
9	Api(ApiHandle) API called.	Diagnostic	N
10	Api(ApiHandle) API returned successfully.	Diagnostic	N
11	Api(ApiHandle) API failed with an error = Result.	Diagnostic	N
12	Api(ApiHandle) API pending completion.	Diagnostic	N
13	Api(ApiHandle) API completed.	Diagnostic	N
14	Api(ApiHandle) API completed with an error = Result.	Diagnostic	N
15	Request: Set Request Option Option (Handle RequestHandle) (Error Error) (Length …	Diagnostic	N
17	Request: WebCreateHttpRequest completed successfully.	Diagnostic	N
18	Session: WebCreateHttpRequest failed with error: Error.	Diagnostic	N
19	ApiObject: WebCloseHttpRequest called (Handle ApiHandle) (Flags Flags).	Diagnostic	N
20	ApiObject WebCloseHttpRequest failed with an error = Error.	Diagnostic	N
21	Synchronous API Event Handle Signall (Event Event) (Error Error) (Information …	Diagnostic	N
22	Synchronous API Event Handle Wait Completed (Handle Handle) (Event Event) (Error …	Diagnostic	N
23	Request: WebSetHttpRequestInformationRoutine completed successfully.	Diagnostic	N
24	Request: WebSetHttpRequestInformationRoutine failed with an error = Error.	Diagnostic	N
25	Request: WebRemoveHttpRequestInformationRoutine completed successfully.	Diagnostic	N
26	Request: WebRemoveHttpRequestInformationRoutine failed with an error = Error.	Diagnostic	N
27	Request: Indicating informational callback to request.	Diagnostic	N
28	Request: Informational callback to request complete.	Diagnostic	N
29	ApiObject: WebCloseSession completed successfully.	Diagnostic	N
30	ApiObject: WebCloseHttpRequest completed sucessfully error = Error.	Diagnostic	N
100	Request: Sending Headers: Headers.	Diagnostic	N
101	Request: Received Headers: Headers.	Diagnostic	N
102	Context: Starting Proxy Resolution.	Diagnostic	N
103	Context: Completed Proxy Resolution.	Diagnostic	N
104	Request: Acquired a connection slot (ConnMgr: ConnMgr), (Connection: …	Diagnostic	N
105	Request: Request on Endpoint (Server Endpoint: ServerEndpoint) (Proxy Endpoint: …	Diagnostic	N
106	Request: Request Message Generated (DataChunk DataChunks[Length]).	Diagnostic	N
107	Request: WebSendHttpRequestEntity (Handle: RequestHandle) (Flags: Flags) …	Diagnostic	N
108	Request: WebSendHttpRequestEntity Inline Completion (Handle: RequestHandle) …	Diagnostic	N
109	Request: HTTP Queuing Entity for Sending (DataChunks DataChunks) (ChunkLength …	Diagnostic	N
110	Request: HTTP Sending Entity (Connection: Connection) (DataChunks DataChunks) …	Diagnostic	N
111	Request: HTTP Send Entity Details (Connection: Connection) (DataChunks …	Diagnostic	N
112	Request: HTTP Sending Entity Complete (Error Error) (Connection: Connection) …	Diagnostic	N
113	Request: Completing WebSendHttpRequest(Entity) (DataChunks DataChunks) (Error …	Diagnostic	N
114	Request: Completing WebSendHttpRequest(Entity) Complete (DataChunks DataChunks).	Diagnostic	N
115	Request: WebHttpReceiveEntityBody (Handle: RequestHandle) (Flags: Flags) …	Diagnostic	N
116	Request: WebHttpReceiveEntityBody Inline Completion (Handle: RequestHandle) …	Diagnostic	N
117	Request: Completing WebHttpReceiveEntityBody (DataChunks DataChunks) (Error …	Diagnostic	N
118	Request: Completing WebHttpReceiveEntityBody Complete (DataChunks DataChunks).	Diagnostic	N
119	Connection: HTTP Connection changing Buffer (OldBuffer OldBuffer …	Diagnostic	N
120	Connection: HTTP Connection Buffer Posting Receive (DataChunks DataChunks) …	Diagnostic	N
121	Connection: HTTP Connection Buffer Completing Receive (DataChunks DataChunks) …	Diagnostic	Y
122	Connection: HTTP Connection Buffer Receive Details (DataChunks DataChunks) …	Diagnostic	N
123	Request: HTTP Parser (Connection Connection) (Buffer: Buffer …	Diagnostic	N
124	Request: HTTP Parser Complete (Connection Connection) (Error Error) (Buffer: …	Diagnostic	N
125	Request: HTTP Parser Reset (Buffer Buffer) (HttpResponseCode HttpResponseCode).	Diagnostic	N
126	Request: HTTP Receive From Parser (DataChunk DataChunks) (ParserChunk ChunkData …	Diagnostic	N
127	Request: HTTP Receive (DataChunk DataChunks) (BytesToRecv BytesToReceive).	Diagnostic	N
128	Request: HTTP Receive Complete (DataChunk DataChunks) (BytesToRecv …	Diagnostic	N
129	Request: HTTP Receive Entity Details (DataChunk DataChunks) (Index Index) …	Diagnostic	N
130	Request: WebSendHttpRequest (Handle: RequestHandle) (Flags: Flags) (DataChunks …	Diagnostic	N
131	Request: WebSendHttpRequest Inline Completion (Handle: RequestHandle) (Error: …	Diagnostic	N
132	Request: WebHttpReceiveResponse (Handle: RequestHandle) (Flags Flags) …	Diagnostic	N
133	Request: WebHttpReceiveEntityBody Inline Completion (Handle: RequestHandle) …	Diagnostic	N
134	Request: Completing WebHttpReceiveEntityBody (Error Error) (ResponseFlags …	Diagnostic	N
135	Request: Completing WebHttpReceiveEntityBody Complete.	Diagnostic	N
136	Request: WebCancelHttpRequest (Handle: RequestHandle) (Flags Flags).	Diagnostic	N
137	Request: WebCancelHttpRequest Complete (Error: Error) (Handle: RequestHandle) …	Diagnostic	N
200	Connection: Connecting (Socket SocketHandle) (Context Context) (RemaingAddress …	Diagnostic	N
201	Connection: Connection established (Socket SocketHandle) (Context Context).	Diagnostic	N
202	Connection: Connect failed with error Error (Socket SocketHandle) (Context …	Diagnostic	N
203	Socket SocketHandle created on Endpoint Connection.	Diagnostic	N
204	Endpoint: Socket Socket Closed (Reason = Reason, Status = Result).	Diagnostic	Y
205	DnsQuery: Name Resolution Request (Name HostName) (Timeout Timeout) …	Diagnostic	N
206	DnsQuery: Name Resolution Request Completed (FQDN FQDN) (Canonical …	Diagnostic	N
207	DnsQuery: Name Resolution Request Failed (Error Error).	Diagnostic	N
208	DnsQuery: Name Resolution Request queued to CacheEntry.	Diagnostic	N
209	ReferenceContext: Name Resolution Request is cancelled.	Diagnostic	N
210	ReferenceContext: Name Resolution Request Timed-out.	Diagnostic	N
211	CacheEntry: Resolving addresses (Host ResolveName) (Flags: Flags).	Diagnostic	N
212	CacheEntry: Address resolution completed (Error = Error) (Host ResolveName) …	Diagnostic	N
213	Connection: Winsock Send Entity Start(DataChunks DataChunks) (Socket …	Diagnostic	N
214	Connection: Winsock Send Entity Complete (Error Error) (Information Information) …	Diagnostic	N
215	Connection: Winsock Recv Entity Start (DataChunks DataChunks) (Socket …	Diagnostic	N
216	Connection: Winsock Recv Entity Complete(Error Error) (Information Information) …	Diagnostic	Y
217	Connection: (H/3 Connection ID Http3ClientConnectionId) Got Stream (Stream …	Diagnostic	N
218	Connection: Read Stream Data Indicated (StreamId StreamId) (Size Size) (Headers …	Diagnostic	N
219	Connection: Stream Created (StreamId StreamId).	Diagnostic	N
220	Connection: Stream Aborted (StreamId StreamId) (HRESULT error Error) (Reset Code …	Diagnostic	N
221	Connection: Processing Initial HTTP/2 Setting (Id SettingId) (Value …	Diagnostic	N
222	Connection: Received WINDOW_UPDATE frame (StreamId StreamId) (WindowIncrement …	Diagnostic	N
223	Connection: Received GOAWAY frame (LastStreamId LastStreamId) (Error Error).	Diagnostic	N
224	Connection: HTTP/2 Connection Aborted (Error Error).	Diagnostic	N
225	Connection: HTTP/2 send window reached flow-control limit (StreamId StreamId) …	Diagnostic	N
700	Connection: InitializeSecurityContext - Credential …	Diagnostic	N
703	Connection: InitializeSecurityContext returned - (Result) Credential …	Diagnostic	N
704	Connection: InitializeSecurityContext Details (Pre) - Credential …	Diagnostic	N
705	Connection: InitializeSecurityContext Details (Post) - Credential …	Diagnostic	N
706	Connection: SSL Encryption (SSLIOContext SslIOContext) Context …	Diagnostic	N
707	Connection: SSL Encryption Complete (SSLIOContext SslIOContext) (ErrorCode: …	Diagnostic	N
708	Connection: SSL Encryption Failed (SSLIOContext SslIOContext) (ErrorCode: Error) …	Diagnostic	N
709	Connection: SSL Encryption Details (SSLIOContext SslIOContext) Context …	Diagnostic	N
710	Connection: SSL Queue Send Entity (SSLIOContext SslIOContext) (DataChunks: …	Diagnostic	N
711	Connection: SSL Send Entity Complete (SSLIOContext: SslIOContext) (Error: Error) …	Diagnostic	N
712	Connection: SSL Cert Validation - (Error: Error) Context …	Diagnostic	N
713	Connection: SSL Cert Validation Failure - Reason (Error: Error) Context …	Diagnostic	N
720	Connection: SSL Queue Recv Entity Data Chunk (SSLIOContext SslIOContext) …	Diagnostic	N
721	Connection: SSL Filling Up Recv Entity Data Chunk (SSLIOContext: SslIOContext) …	Diagnostic	N
722	Connection: SSL Decryption - Context Handle(ContextHandleHigh:ContextHandleLow) …	Diagnostic	N
723	Connection: SSL Decryption Complete (SecStatus SecStatus) (Error Error) Context …	Diagnostic	N
724	Connection: SSL Receive Buffer Posting Receive (DataChunk DataChunks) (Buffer …	Diagnostic	N
725	Connection: SSL Receive Buffer Receive Complete (DataChunk DataChunks) (Error …	Diagnostic	Y
726	Connection: SSL Receive Buffer Details: (Buffer …	Diagnostic	N
727	Connection: SSL Receive Buffer Posting Receive (Buffer OldBuffer) (NewBuffer: …	Diagnostic	N
728	Connection: SSL AcquireCredentialsHandle - (EnabledProtocols EnabledProtocols) …	Diagnostic	N
729	Connection: SSL AcquireCredentialsHandle returned - (CredHandleLow) Credential …	Diagnostic	N
730	Connection: SSL AcquireCredentialsHandle failed - (CredHandleLow) …	Diagnostic	N
731	Failed to create HTTP/3 API session due to TLS 1.	Operational	N
900	ProtocolObject: WebCompleteProtocolUpgrade completed successfully.	Diagnostic	N
901	ProtocolObject: WebCompleteProtocolUpgrade failed with error: Error.	Diagnostic	N
902	Request: WebProtocolCancelHandle (Handle: RequestHandle).	Diagnostic	N
903	Request: WebProtocolCancelHandle Complete (Error: Flags) (Handle: …	Diagnostic	N
904	ApiObject: WebCloseProtocolHandle called (Handle ApiHandle).	Diagnostic	N
905	ApiObject: WebCloseProtocolHandle completed (Error Error) (Handle ApiHandle).	Diagnostic	N
906	Request: Set Protocol Option Option (Handle RequestHandle) (Error Error) (Length …	Diagnostic	N
907	Request: WebProtocolSendData (Handle: RequestHandle) (Flags: Flags) (DataChunks …	Diagnostic	N
908	Request: WebProtocolSendData Inline Completion (Handle: RequestHandle) (Error: …	Diagnostic	N
909	ProtocolObject: Completing WebProtocolSendData (Handle: Handle) (Error: Context) …	Diagnostic	N
910	ProtocolObject: Completing WebProtocolSendData Complete (Handle: Handle) (Error: …	Diagnostic	N
911	Request: WebProtocolReceiveData (Handle: RequestHandle) (Flags: Flags) …	Diagnostic	N
912	Request: WebProtocolReceiveData Inline Completion (Handle: RequestHandle) …	Diagnostic	N
913	ProtocolObject: Completing WebProtocolReceiveData (Handle: Handle) (Error: …	Diagnostic	N
914	ProtocolObject: Completing WebProtocolReceiveData Complete (Handle: Handle) …	Diagnostic	N
2100	Context: =====Request Initialize===================.	Diagnostic	N
2101	Context: =====Query Endpoints======================.	Diagnostic	N
2102	Context: =====Waiting For Available Connection=====.	Diagnostic	N
2111	Context: =====Request Connect======================.	Diagnostic	N
2112	Context: =====Name Resolution======================.	Diagnostic	N
2113	Context: =====TCP Connect==========================.	Diagnostic	N
2114	Context: =====SSL Negotiation======================.	Diagnostic	N
2120	Context: =====Generate Headers=====================.	Diagnostic	N
2121	Context: =====Send Headers=========================.	Diagnostic	N
2122	Context: =====Send Entity==========================.	Diagnostic	N
2123	Context: =====Send Complete========================.	Diagnostic	N
2130	Context: =====Receive Headers======================.	Diagnostic	N
2131	Context: =====Receive Entity=======================.	Diagnostic	N
2132	Context: =====Receive Complete=====================.	Diagnostic	N
2140	Context: =====Request Restart======================.	Diagnostic	N
2141	Context: =====Request Done=========================.	Diagnostic	N
59992	Restore Thread Token Token (Error: Error).	Diagnostic	N
59993	Set Thread Token Token (OldToken OldToken) (Error: Error).	Diagnostic	N
59994	Get Thread Token Token (Error: Error) (SID: SID).	Diagnostic	N
59995	Canceling EtwQueueActionType Thread Action (Context: Context).	Diagnostic	N
59996	Queue EtwQueueActionType Thread Action (Context: Context).	Diagnostic	N
59997	Stopping EtwQueueActionType Thread Action (Context: Context).	Diagnostic	Y
59998	Starting EtwQueueActionType Thread Action (Context: Context).	Diagnostic	Y
59999	Message.	Diagnostic	N

Event ID 1: ApiObject: WebInitialize completed successfully (ApiVersion ApiVersion) (Flags Flags) -> (API Handle = ApiHandle).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ApiInit

Description

ApiObject: WebInitialize completed successfully (ApiVersion ApiVersion) (Flags Flags) -> (API Handle = ApiHandle).

Message #

%1: WebInitialize completed successfully (ApiVersion %3) (Flags %4) -> (API Handle = %2).

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`ApiVersion` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 2: WebInitialize failed with an error = Error (ApiVersion ApiVersion) (Flags Flags).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ApiInit

Description

WebInitialize failed with an error = Error (ApiVersion ApiVersion) (Flags Flags).

Message #

WebInitialize failed with an error = %5 (ApiVersion %3) (Flags %4)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`ApiVersion` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 3: ApiObject WebTerminate completed successfully.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ApiTerminate

Description

ApiObject WebTerminate completed successfully. (Handle ApiHandle) (Flags Flags).

Message #

%1 WebTerminate completed successfully. (Handle %2) (Flags %3)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 4: ApiObject WebTerminate failed with an error = Error.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ApiTerminate

Description

ApiObject WebTerminate failed with an error = Error. (Handle ApiHandle) (Flags Flags).

Message #

%1 WebTerminate failed with an error = %4. (Handle %2) (Flags %3)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 5: Session: WebCreateSession completed successfully.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SessionCreate

Description

Session: WebCreateSession completed successfully. (ApiHandle ApiObject[ApiHandle]) (Flags: Flags) -> (Session Handle: SessionHandle).

Message #

%3: WebCreateSession completed successfully. (ApiHandle %1[%2]) (Flags: %5) -> (Session Handle: %4)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Session` Pointer
`SessionHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 6: ApiObject: WebCreateSession failed with an error = Error.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SessionCreate

Description

ApiObject: WebCreateSession failed with an error = Error. (ApiHandle ApiObject[ApiHandle]) (Flags: Flags).

Message #

%1: WebCreateSession failed with an error = %6. (ApiHandle %1[%2]) (Flags: %5)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Session` Pointer
`SessionHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 7: ApiObject: WebCloseSession called (Handle ApiHandle) (Flags Flags).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SessionClose
Opcode: Start

Description

ApiObject: WebCloseSession called (Handle ApiHandle) (Flags Flags).

Message #

%1: WebCloseSession called (Handle %2) (Flags %3)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 8: ApiObject: WebCloseSession failed with an error = Error.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SessionClose
Opcode: Stop

Description

ApiObject: WebCloseSession failed with an error = Error. (Handle ApiHandle) (Flags Flags).

Message #

%1: WebCloseSession failed with an error = %4. (Handle %2) (Flags %3)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 9: Api(ApiHandle) API called.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: WebIOAPI
Opcode: Start

Description

Api(ApiHandle) API called.

Message #

%2(%1) API called.

Fields #

Name	Description
`ApiHandle` UInt64
`Api` AnsiString

Event ID 10: Api(ApiHandle) API returned successfully.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: WebIOAPI
Opcode: Stop

Description

Api(ApiHandle) API returned successfully.

Message #

%2(%1) API returned successfully.

Fields #

Name	Description
`ApiHandle` UInt64
`Api` AnsiString
`Result` UInt32

Event ID 11: Api(ApiHandle) API failed with an error = Result.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: WebIOAPI
Opcode: Stop

Description

Api(ApiHandle) API failed with an error = Result.

Message #

%2(%1) API failed with an error = %3.

Fields #

Name	Description
`ApiHandle` UInt64
`Api` AnsiString
`Result` UInt32

Event ID 12: Api(ApiHandle) API pending completion.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: WebIOAPI

Description

Api(ApiHandle) API pending completion.

Message #

%2(%1) API pending completion.

Fields #

Name	Description
`ApiHandle` UInt64
`Api` AnsiString

Event ID 13: Api(ApiHandle) API completed.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: WebIOAPI
Opcode: Stop

Description

Api(ApiHandle) API completed.

Message #

%2(%1) API completed.

Fields #

Name	Description
`ApiHandle` UInt64
`Api` AnsiString
`Result` UInt32

Event ID 14: Api(ApiHandle) API completed with an error = Result.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: WebIOAPI
Opcode: Stop

Description

Api(ApiHandle) API completed with an error = Result.

Message #

%2(%1) API completed with an error = %3.

Fields #

Name	Description
`ApiHandle` UInt64
`Api` AnsiString
`Result` UInt32

Event ID 15: Request: Set Request Option Option (Handle RequestHandle) (Error Error) (Length Length) (Value Value).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestConfiguration
Opcode: Set

Description

Request: Set Request Option Option (Handle RequestHandle) (Error Error) (Length Length) (Value Value).

Message #

%1: Set Request Option %3 (Handle %2) (Error %6) (Length %4) (Value %5)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Option` UInt32
`Length` UInt32
`Value` Binary
`Error` UInt32

Event ID 17: Request: WebCreateHttpRequest completed successfully.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestCreate

Description

Request: WebCreateHttpRequest completed successfully. (Session Session[SessionHandle]) (Method Method) (URI URI) (Version VersionMajor.VersionMinor) -> (Request Handle RequestHandle).

Message #

%1: WebCreateHttpRequest completed successfully. (Session %3[%4]) (Method %5) (URI %6) (Version %7.%8) -> (Request Handle %2)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Session` Pointer
`SessionHandle` UInt64
`Method` AnsiString
`URI` UnicodeString
`VersionMajor` UInt16
`VersionMinor` UInt16
`Error` UInt32

Event ID 18: Session: WebCreateHttpRequest failed with error: Error.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestCreate

Description

Session: WebCreateHttpRequest failed with error: Error. (Session Session[SessionHandle]) (Method Method) (URI URI) (Version VersionMajor.VersionMinor).

Message #

%3: WebCreateHttpRequest failed with error: %9. (Session %3[%4]) (Method %5) (URI %6) (Version %7.%8)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Session` Pointer
`SessionHandle` UInt64
`Method` AnsiString
`URI` UnicodeString
`VersionMajor` UInt16
`VersionMinor` UInt16
`Error` UInt32

Event ID 19: ApiObject: WebCloseHttpRequest called (Handle ApiHandle) (Flags Flags).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestClose
Opcode: Start

Description

ApiObject: WebCloseHttpRequest called (Handle ApiHandle) (Flags Flags).

Message #

%1: WebCloseHttpRequest called (Handle %2) (Flags %3)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 20: ApiObject WebCloseHttpRequest failed with an error = Error.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestClose
Opcode: Stop

Description

ApiObject WebCloseHttpRequest failed with an error = Error. (Handle ApiHandle) (Flags Flags).

Message #

%1 WebCloseHttpRequest failed with an error = %4. (Handle %2) (Flags %3)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 21: Synchronous API Event Handle Signall (Event Event) (Error Error) (Information Information).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SyncApiWait

Description

Synchronous API Event Handle Signall (Event Event) (Error Error) (Information Information).

Message #

Synchronous API Event Handle Signall (Event %2) (Error %3) (Information %4)

Fields #

Name	Description
`Handle` UInt64
`Event` UInt64
`Error` UInt32
`Information` UInt64

Event ID 22: Synchronous API Event Handle Wait Completed (Handle Handle) (Event Event) (Error Error) (Information Information).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SyncApiWait

Description

Synchronous API Event Handle Wait Completed (Handle Handle) (Event Event) (Error Error) (Information Information).

Message #

Synchronous API Event Handle Wait Completed (Handle %1) (Event %2) (Error %3) (Information %4)

Fields #

Name	Description
`Handle` UInt64
`Event` UInt64
`Error` UInt32
`Information` UInt64

Event ID 23: Request: WebSetHttpRequestInformationRoutine completed successfully.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestConfiguration
Opcode: Set

Description

Request: WebSetHttpRequestInformationRoutine completed successfully. (Handle RequestHandle) (Flags Flags) (InformationRoutine InformationRoutine) (InformationContext InformationContext).

Message #

%1: WebSetHttpRequestInformationRoutine completed successfully. (Handle %2) (Flags %3) (InformationRoutine %4) (InformationContext %5)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`InformationRoutine` Pointer
`InformationContext` Pointer
`Error` UInt32

Event ID 24: Request: WebSetHttpRequestInformationRoutine failed with an error = Error.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestConfiguration
Opcode: Set

Description

Request: WebSetHttpRequestInformationRoutine failed with an error = Error. (Handle RequestHandle) (Flags Flags) (InformationRoutine InformationRoutine) (InformationContext InformationContext).

Message #

%1: WebSetHttpRequestInformationRoutine failed with an error = %6. (Handle %2) (Flags %3) (InformationRoutine %4) (InformationContext %5)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`InformationRoutine` Pointer
`InformationContext` Pointer
`Error` UInt32

Event ID 25: Request: WebRemoveHttpRequestInformationRoutine completed successfully.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestConfiguration
Opcode: Set

Description

Request: WebRemoveHttpRequestInformationRoutine completed successfully. (Handle RequestHandle) (Flags Flags).

Message #

%1: WebRemoveHttpRequestInformationRoutine completed successfully. (Handle %2) (Flags %3)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`InformationRoutine` Pointer
`InformationContext` Pointer
`Error` UInt32

Event ID 26: Request: WebRemoveHttpRequestInformationRoutine failed with an error = Error.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestConfiguration
Opcode: Set

Description

Request: WebRemoveHttpRequestInformationRoutine failed with an error = Error. (Handle RequestHandle) (Flags Flags).

Message #

%1: WebRemoveHttpRequestInformationRoutine failed with an error = %6. (Handle %2) (Flags %3)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`InformationRoutine` Pointer
`InformationContext` Pointer
`Error` UInt32

Event ID 27: Request: Indicating informational callback to request.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: Information

Description

Request: Indicating informational callback to request. (PendingCount PendingCount) (InformationRoutine InformationRoutine) (InformationContext InformationContext) (Type Type) (Information Information) (InformationLength InformationLength.

Message #

%1: Indicating informational callback to request. (PendingCount %2) (InformationRoutine %3) (InformationContext %4) (Type %5) (Information %6) (InformationLength %7

Fields #

Name	Description
`Request` Pointer
`PendingCount` UInt32
`InformationRoutine` Pointer
`InformationContext` Pointer
`Type` UInt32
`Information` Pointer
`InformationLength` UInt64

Event ID 28: Request: Informational callback to request complete.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: Information

Description

Request: Informational callback to request complete. (PendingCount PendingCount) (InformationRoutine InformationRoutine) (InformationContext InformationContext) (Type Type) (Information Information) (InformationLength InformationLength.

Message #

%1: Informational callback to request complete. (PendingCount %2) (InformationRoutine %3) (InformationContext %4) (Type %5) (Information %6) (InformationLength %7

Fields #

Name	Description
`Request` Pointer
`PendingCount` UInt32
`InformationRoutine` Pointer
`InformationContext` Pointer
`Type` UInt32
`Information` Pointer
`InformationLength` UInt64

Event ID 29: ApiObject: WebCloseSession completed successfully.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SessionClose
Opcode: Stop

Description

ApiObject: WebCloseSession completed successfully. (Handle ApiHandle) (Flags Flags).

Message #

%1: WebCloseSession completed successfully. (Handle %2) (Flags %3)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 30: ApiObject: WebCloseHttpRequest completed sucessfully error = Error.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestClose
Opcode: Stop

Description

ApiObject: WebCloseHttpRequest completed sucessfully error = Error. (Handle ApiHandle) (Flags Flags).

Message #

%1: WebCloseHttpRequest completed sucessfully error = %4. (Handle %2) (Flags %3)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 100: Request: Sending Headers: Headers.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestHeader

Description

Request: Sending Headers: Headers.

Message #

%1: Sending Headers: %3

Fields #

Name	Description
`Request` Pointer
`Length` UInt16
`Headers` AnsiString

Event ID 101: Request: Received Headers: Headers.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestHeader

Description

Request: Received Headers: Headers.

Message #

%1: Received Headers: %3

Fields #

Name	Description
`Request` Pointer
`Length` UInt16
`Headers` AnsiString

Event ID 102: Context: Starting Proxy Resolution.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProxyResolution
Opcode: Start

Description

Context: Starting Proxy Resolution.

Message #

%1: Starting Proxy Resolution

Fields #

Name	Description
`Context` Pointer

Event ID 103: Context: Completed Proxy Resolution.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProxyResolution
Opcode: Stop

Description

Context: Completed Proxy Resolution.

Message #

%1: Completed Proxy Resolution

Fields #

Name	Description
`Context` Pointer

Event ID 104: Request: Acquired a connection slot (ConnMgr: ConnMgr), (Connection: Connection).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestWaitingForConnection
Opcode: Stop

Description

Request: Acquired a connection slot (ConnMgr: ConnMgr), (Connection: Connection).

Message #

%1: Acquired a connection slot (ConnMgr: %2), (Connection: %3)

Fields #

Name	Description
`Request` Pointer
`ConnMgr` Pointer
`Connection` Pointer

Event ID 105: Request: Request on Endpoint (Server Endpoint: ServerEndpoint) (Proxy Endpoint: ProxyEndpoint) (Connection Manager: ConnectionManager).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: Endpoint

Description

Request: Request on Endpoint (Server Endpoint: ServerEndpoint) (Proxy Endpoint: ProxyEndpoint) (Connection Manager: ConnectionManager).

Message #

%1: Request on Endpoint (Server Endpoint: %2) (Proxy Endpoint: %3) (Connection Manager: %4)

Fields #

Name	Description
`Request` Pointer
`ServerEndpoint` Pointer
`ProxyEndpoint` Pointer
`ConnectionManager` Pointer

Event ID 106: Request: Request Message Generated (DataChunk DataChunks[Length]).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestGenerateHeaders
Opcode: Stop

Description

Request: Request Message Generated (DataChunk DataChunks[Length]).

Message #

%1: Request Message Generated (DataChunk %2[%3])

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`Length` UInt64

Event ID 107: Request: WebSendHttpRequestEntity (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestSendEntity
Opcode: Start

Description

Request: WebSendHttpRequestEntity (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebSendHttpRequestEntity (Handle: %2) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 108: Request: WebSendHttpRequestEntity Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestSendEntity
Opcode: Stop

Description

Request: WebSendHttpRequestEntity Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebSendHttpRequestEntity Inline Completion (Handle: %2) (Error: %7) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 109: Request: HTTP Queuing Entity for Sending (DataChunks DataChunks) (ChunkLength TotalChunkLength) (IsEntity IsEntity).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestEntityTracker
Opcode: Queue

Description

Request: HTTP Queuing Entity for Sending (DataChunks DataChunks) (ChunkLength TotalChunkLength) (IsEntity IsEntity) (All Entity Posted? RequestEntityComplete).

Message #

%1: HTTP Queuing Entity for Sending (DataChunks %2) (ChunkLength %3) (IsEntity %4) (All Entity Posted? %5)

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`TotalChunkLength` UInt64
`IsEntity` Boolean
`RequestEntityComplete` Boolean

Event ID 110: Request: HTTP Sending Entity (Connection: Connection) (DataChunks DataChunks) (PendingSendCount PendingSendCount).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestEntityTracker
Opcode: Start

Description

Request: HTTP Sending Entity (Connection: Connection) (DataChunks DataChunks) (PendingSendCount PendingSendCount) (LastSend? LastSend).

Message #

%1: HTTP Sending Entity (Connection: %2) (DataChunks %3) (PendingSendCount %4) (LastSend? %5)

Fields #

Name	Description
`Request` Pointer
`Connection` Pointer
`DataChunks` Pointer
`PendingSendCount` UInt32
`LastSend` Boolean
`Error` UInt32

Event ID 111: Request: HTTP Send Entity Details (Connection: Connection) (DataChunks DataChunks) (Index Index) (Buffer Buffer [Length]) Data: Data.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestEntityTracker

Description

Request: HTTP Send Entity Details (Connection: Connection) (DataChunks DataChunks) (Index Index) (Buffer Buffer [Length]) Data: Data.

Message #

%1: HTTP Send Entity Details (Connection: %2) (DataChunks %3) (Index %4) (Buffer %5 [%6]) Data: %7

Fields #

Name	Description
`Request` Pointer
`Connection` Pointer
`DataChunks` Pointer
`Index` UInt32
`Buffer` Pointer
`Length` UInt32
`Data` Binary

Event ID 112: Request: HTTP Sending Entity Complete (Error Error) (Connection: Connection) (DataChunks DataChunks) (PendingSendCount PendingSendCount).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestEntityTracker
Opcode: Stop

Description

Request: HTTP Sending Entity Complete (Error Error) (Connection: Connection) (DataChunks DataChunks) (PendingSendCount PendingSendCount) (LastSend? LastSend).

Message #

%1: HTTP Sending Entity Complete (Error %6) (Connection: %2) (DataChunks %3) (PendingSendCount %4) (LastSend? %5)

Fields #

Name	Description
`Request` Pointer
`Connection` Pointer
`DataChunks` Pointer
`PendingSendCount` UInt32
`LastSend` Boolean
`Error` UInt32

Event ID 113: Request: Completing WebSendHttpRequest(Entity) (DataChunks DataChunks) (Error Error) (CompletionContext CompletionContext) (CompletionInformation CompletionInformation).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestEntityCompleteCallback
Opcode: Start

Description

Request: Completing WebSendHttpRequest(Entity) (DataChunks DataChunks) (Error Error) (CompletionContext CompletionContext) (CompletionInformation CompletionInformation).

Message #

%1: Completing WebSendHttpRequest(Entity) (DataChunks %2) (Error %3) (CompletionContext %4) (CompletionInformation %5)

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`Error` UInt32
`CompletionContext` Pointer
`CompletionInformation` UInt64

Event ID 114: Request: Completing WebSendHttpRequest(Entity) Complete (DataChunks DataChunks).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestEntityCompleteCallback
Opcode: Stop

Description

Request: Completing WebSendHttpRequest(Entity) Complete (DataChunks DataChunks).

Message #

%1: Completing WebSendHttpRequest(Entity) Complete (DataChunks %2)

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`Error` UInt32
`CompletionContext` Pointer
`CompletionInformation` UInt64

Event ID 115: Request: WebHttpReceiveEntityBody (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseRecieveEntity
Opcode: Start

Description

Request: WebHttpReceiveEntityBody (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebHttpReceiveEntityBody (Handle: %2) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 116: Request: WebHttpReceiveEntityBody Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseRecieveEntity
Opcode: Stop

Description

Request: WebHttpReceiveEntityBody Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebHttpReceiveEntityBody Inline Completion (Handle: %2) (Error: %7) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 117: Request: Completing WebHttpReceiveEntityBody (DataChunks DataChunks) (Error Error) (CompletionContext CompletionContext) (CompletionInformation CompletionInformation).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseEntityCompleteCallback
Opcode: Start

Description

Request: Completing WebHttpReceiveEntityBody (DataChunks DataChunks) (Error Error) (CompletionContext CompletionContext) (CompletionInformation CompletionInformation).

Message #

%1: Completing WebHttpReceiveEntityBody (DataChunks %2) (Error %3) (CompletionContext %4) (CompletionInformation %5)

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`Error` UInt32
`CompletionContext` Pointer
`CompletionInformation` UInt64

Event ID 118: Request: Completing WebHttpReceiveEntityBody Complete (DataChunks DataChunks).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseEntityCompleteCallback
Opcode: Stop

Description

Request: Completing WebHttpReceiveEntityBody Complete (DataChunks DataChunks).

Message #

%1: Completing WebHttpReceiveEntityBody Complete (DataChunks %2)

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`Error` UInt32
`CompletionContext` Pointer
`CompletionInformation` UInt64

Event ID 119: Connection: HTTP Connection changing Buffer (OldBuffer OldBuffer [OldBufferLength]) (NewBuffer NewBuffer [NewBufferLength]) (Carryover BufferLengthData).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseConnectionBufferReceive
Opcode: Reallocate

Description

Connection: HTTP Connection changing Buffer (OldBuffer OldBuffer [OldBufferLength]) (NewBuffer NewBuffer [NewBufferLength]) (Carryover BufferLengthData).

Message #

%1: HTTP Connection changing Buffer (OldBuffer %2 [%3]) (NewBuffer %5 [%6]) (Carryover %4)

Fields #

Name	Description
`Connection` Pointer
`OldBuffer` Pointer
`OldBufferLength` UInt32
`BufferLengthData` UInt32
`NewBuffer` Pointer
`NewBufferLength` UInt32

Event ID 120: Connection: HTTP Connection Buffer Posting Receive (DataChunks DataChunks) (Buffer: Buffer [BufferLengthConsumed/BufferLengthData/BufferLengthRemaining]).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseConnectionBufferReceive
Opcode: Start

Description

Connection: HTTP Connection Buffer Posting Receive (DataChunks DataChunks) (Buffer: Buffer [BufferLengthConsumed/BufferLengthData/BufferLengthRemaining]).

Message #

%1: HTTP Connection Buffer Posting Receive (DataChunks %2) (Buffer: %3 [%4/%5/%6])

Fields #

Name	Description
`Connection` Pointer
`DataChunks` Pointer
`Buffer` Pointer
`BufferLengthConsumed` UInt32
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`Error` UInt32
`Information` UInt64

Event ID 121: Connection: HTTP Connection Buffer Completing Receive (DataChunks DataChunks) (Buffer: Buffer [BufferLengthConsumed/BufferLengthData/BufferLengthRemaining]) (Error Error) (CompletionInformation Inf...

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ResponseConnectionBufferReceive
Opcode: Stop

Description

Connection: HTTP Connection Buffer Completing Receive (DataChunks DataChunks) (Buffer: Buffer [BufferLengthConsumed/BufferLengthData/BufferLengthRemaining]) (Error Error) (CompletionInformation Information).

Message #

%1: HTTP Connection Buffer Completing Receive (DataChunks %2) (Buffer: %3 [%4/%5/%6]) (Error %7)  (CompletionInformation %8)

Fields #

Name	Description
`Connection` Pointer
`DataChunks` Pointer
`Buffer` Pointer
`BufferLengthConsumed` UInt32
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`Error` UInt32
`Information` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebIO",
    "guid": "{50B3E73C-9370-461D-BB9F-26F32D68887D}",
    "event_source_name": "",
    "event_id": 121,
    "version": 0,
    "level": 5,
    "task": 415,
    "opcode": 2,
    "keywords": "0x0000000200000000",
    "time_created": "2026-06-02T04:01:52.944+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{EB64A0B3-7FFC-0000-D588-CD01FC2D780D}"
    },
    "execution": {
      "process_id": 11772,
      "thread_id": 13132
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Buffer": "0x23E91026950",
    "BufferLengthConsumed": 0,
    "BufferLengthData": 0,
    "BufferLengthRemaining": 4048,
    "Connection": "0x23E900EFC70",
    "DataChunks": "0x23E900F0838",
    "Error": 995,
    "Information": 0
  },
  "message": "Task.ResponseConnectionBufferReceive"
}

Event ID 122: Connection: HTTP Connection Buffer Receive Details (DataChunks DataChunks) (Length Length) Data: Data.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseConnectionBufferReceive

Description

Connection: HTTP Connection Buffer Receive Details (DataChunks DataChunks) (Length Length) Data: Data.

Message #

%1: HTTP Connection Buffer Receive Details (DataChunks %2) (Length %3) Data: %4

Fields #

Name	Description
`Connection` Pointer
`DataChunks` Pointer
`Length` UInt32
`Data` Binary

Event ID 123: Request: HTTP Parser (Connection Connection) (Buffer: Buffer [BufferLengthConsumed/BufferLengthData/BufferLengthRemaining]) (ParserChunk ChunkData [ChunkDataLength]).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseParser
Opcode: Start

Description

Request: HTTP Parser (Connection Connection) (Buffer: Buffer [BufferLengthConsumed/BufferLengthData/BufferLengthRemaining]) (ParserChunk ChunkData [ChunkDataLength]).

Message #

%1: HTTP Parser (Connection %2) (Buffer: %3 [%4/%5/%6]) (ParserChunk %7 [%8])

Fields #

Name	Description
`Request` Pointer
`Connection` Pointer
`Buffer` Pointer
`BufferLengthConsumed` UInt32
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`ChunkData` Pointer
`ChunkDataLength` UInt32
`Error` UInt32

Event ID 124: Request: HTTP Parser Complete (Connection Connection) (Error Error) (Buffer: Buffer [BufferLengthConsumed/BufferLengthData/BufferLengthRemaining]) (ParserChunk ChunkData [ChunkDataLength]).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseParser
Opcode: Stop

Description

Request: HTTP Parser Complete (Connection Connection) (Error Error) (Buffer: Buffer [BufferLengthConsumed/BufferLengthData/BufferLengthRemaining]) (ParserChunk ChunkData [ChunkDataLength]).

Message #

%1: HTTP Parser Complete (Connection %2) (Error %9) (Buffer: %3 [%4/%5/%6]) (ParserChunk %7 [%8])

Fields #

Name	Description
`Request` Pointer
`Connection` Pointer
`Buffer` Pointer
`BufferLengthConsumed` UInt32
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`ChunkData` Pointer
`ChunkDataLength` UInt32
`Error` UInt32

Event ID 125: Request: HTTP Parser Reset (Buffer Buffer) (HttpResponseCode HttpResponseCode).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseParser
Opcode: Reset

Description

Request: HTTP Parser Reset (Buffer Buffer) (HttpResponseCode HttpResponseCode).

Message #

%1: HTTP Parser Reset (Buffer %2) (HttpResponseCode %3)

Fields #

Name	Description
`Request` Pointer
`Buffer` Pointer
`HttpResponseCode` UInt32

Event ID 126: Request: HTTP Receive From Parser (DataChunk DataChunks) (ParserChunk ChunkData [ChunkDataLength]) (Error Error) (Context CompletionContext) (Information CompletionInformation).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseParser

Description

Request: HTTP Receive From Parser (DataChunk DataChunks) (ParserChunk ChunkData [ChunkDataLength]) (Error Error) (Context CompletionContext) (Information CompletionInformation).

Message #

%1: HTTP Receive From Parser (DataChunk %2) (ParserChunk %3 [%4]) (Error %5) (Context %6) (Information %7)

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`ChunkData` Pointer
`ChunkDataLength` UInt32
`Error` UInt32
`CompletionContext` Pointer
`CompletionInformation` UInt64

Event ID 127: Request: HTTP Receive (DataChunk DataChunks) (BytesToRecv BytesToReceive).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseDirectReceiveEntity
Opcode: Start

Description

Request: HTTP Receive (DataChunk DataChunks) (BytesToRecv BytesToReceive).

Message #

%1: HTTP Receive (DataChunk %2) (BytesToRecv %3)

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`BytesToReceive` UInt32
`Error` UInt32
`CompletionContext` Pointer
`CompletionInformation` UInt64

Event ID 128: Request: HTTP Receive Complete (DataChunk DataChunks) (BytesToRecv BytesToReceive) (Error Error) (Context CompletionContext) (Information CompletionInformation).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseDirectReceiveEntity
Opcode: Stop

Description

Request: HTTP Receive Complete (DataChunk DataChunks) (BytesToRecv BytesToReceive) (Error Error) (Context CompletionContext) (Information CompletionInformation).

Message #

%1: HTTP Receive Complete (DataChunk %2) (BytesToRecv %3) (Error %4) (Context %5) (Information %6)

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`BytesToReceive` UInt32
`Error` UInt32
`CompletionContext` Pointer
`CompletionInformation` UInt64

Event ID 129: Request: HTTP Receive Entity Details (DataChunk DataChunks) (Index Index) (Length Length) Data Data.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseDirectReceiveEntity

Description

Request: HTTP Receive Entity Details (DataChunk DataChunks) (Index Index) (Length Length) Data Data.

Message #

%1: HTTP Receive Entity Details (DataChunk %2) (Index %3) (Length %4) Data %5

Fields #

Name	Description
`Request` Pointer
`DataChunks` Pointer
`Index` UInt32
`Length` UInt32
`Data` Binary

Event ID 130: Request: WebSendHttpRequest (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestSend
Opcode: Start

Description

Request: WebSendHttpRequest (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebSendHttpRequest (Handle: %2) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 131: Request: WebSendHttpRequest Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestSend
Opcode: Stop

Description

Request: WebSendHttpRequest Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebSendHttpRequest Inline Completion (Handle: %2) (Error: %7) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 132: Request: WebHttpReceiveResponse (Handle: RequestHandle) (Flags Flags) (ResponseFlags ResponseFlags) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseReceive
Opcode: Start

Description

Request: WebHttpReceiveResponse (Handle: RequestHandle) (Flags Flags) (ResponseFlags ResponseFlags) CompletionContext (CompletionContext).

Message #

%1: WebHttpReceiveResponse (Handle: %2) (Flags %3) (ResponseFlags %4) CompletionContext (%5)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`ResponseFlags` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 133: Request: WebHttpReceiveEntityBody Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (ResponseFlags ResponseFlags) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseReceive
Opcode: Stop

Description

Request: WebHttpReceiveEntityBody Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (ResponseFlags ResponseFlags) CompletionContext (CompletionContext).

Message #

%1: WebHttpReceiveEntityBody Inline Completion (Handle: %2) (Error: %6) (Flags: %3) (ResponseFlags %4) CompletionContext (%5)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`ResponseFlags` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 134: Request: Completing WebHttpReceiveEntityBody (Error Error) (ResponseFlags ResponseFlags) (CompletionInformation CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseReceiveCompleteCallback
Opcode: Start

Description

Request: Completing WebHttpReceiveEntityBody (Error Error) (ResponseFlags ResponseFlags) (CompletionInformation CompletionContext).

Message #

%1: Completing WebHttpReceiveEntityBody (Error %3) (ResponseFlags %2) (CompletionInformation %4)

Fields #

Name	Description
`Request` Pointer
`ResponseFlags` UInt32
`Error` UInt32
`CompletionContext` Pointer

Event ID 135: Request: Completing WebHttpReceiveEntityBody Complete.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ResponseReceiveCompleteCallback
Opcode: Stop

Description

Request: Completing WebHttpReceiveEntityBody Complete.

Message #

%1: Completing WebHttpReceiveEntityBody Complete

Fields #

Name	Description
`Request` Pointer
`ResponseFlags` UInt32
`Error` UInt32
`CompletionContext` Pointer

Event ID 136: Request: WebCancelHttpRequest (Handle: RequestHandle) (Flags Flags).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestCancel
Opcode: Start

Description

Request: WebCancelHttpRequest (Handle: RequestHandle) (Flags Flags).

Message #

%1: WebCancelHttpRequest (Handle: %2) (Flags %3)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`Error` UInt32

Event ID 137: Request: WebCancelHttpRequest Complete (Error: Error) (Handle: RequestHandle) (Flags Flags).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestCancel
Opcode: Stop

Description

Request: WebCancelHttpRequest Complete (Error: Error) (Handle: RequestHandle) (Flags Flags).

Message #

%1: WebCancelHttpRequest Complete (Error: %4) (Handle: %2) (Flags %3)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`Error` UInt32

Event ID 200: Connection: Connecting (Socket SocketHandle) (Context Context) (RemaingAddress RemainingAddressCount) Address: Address.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionSocketConnect
Opcode: Start

Description

Connection: Connecting (Socket SocketHandle) (Context Context) (RemaingAddress RemainingAddressCount) Address: Address.

Message #

%1: Connecting (Socket %2) (Context %5) (RemaingAddress %6) Address: %4.

Fields #

Name	Description
`Connection` Pointer
`SocketHandle` UInt64
`AddressLength` UInt32
`Address` UnicodeString
`Context` Pointer
`RemainingAddressCount` UInt64
`Error` UInt32
`Http3ClientConnectionId` UInt64

Event ID 201: Connection: Connection established (Socket SocketHandle) (Context Context).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionSocketConnect
Opcode: Stop

Description

Connection: Connection established (Socket SocketHandle) (Context Context).

Message #

%1: Connection established (Socket %2) (Context %5)

Fields #

Name	Description
`Connection` Pointer
`SocketHandle` UInt64
`AddressLength` UInt32
`Address` UnicodeString
`Context` Pointer
`RemainingAddressCount` UInt64
`Error` UInt32
`Http3ClientConnectionId` UInt64

Event ID 202: Connection: Connect failed with error Error (Socket SocketHandle) (Context Context) (RemaingAddress RemainingAddressCount).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionSocketConnect
Opcode: Stop

Description

Connection: Connect failed with error Error (Socket SocketHandle) (Context Context) (RemaingAddress RemainingAddressCount).

Message #

%1: Connect failed with error %7 (Socket %2) (Context %5) (RemaingAddress %6)

Fields #

Name	Description
`Connection` Pointer
`SocketHandle` UInt64
`AddressLength` UInt32
`Address` UnicodeString
`Context` Pointer
`RemainingAddressCount` UInt64
`Error` UInt32
`Http3ClientConnectionId` UInt64

Event ID 203: Socket SocketHandle created on Endpoint Connection.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionSocketCreate

Description

Socket SocketHandle created on Endpoint Connection.

Message #

Socket %2 created on Endpoint %1.

Fields #

Name	Description
`Connection` Pointer
`SocketHandle` UInt64
`Error` UInt32
`Http3ClientConnectionId` UInt64

Event ID 204: Endpoint: Socket Socket Closed (Reason = Reason, Status = Result).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ConnectionSocketClose
Opcode: win:Info

Description

Endpoint: Socket Socket Closed (Reason = Reason, Status = Result).

Message #

%1: Socket %2 Closed (Reason = %3, Status = %4).

Fields #

Name	Description
`Endpoint` Pointer
`Socket` UInt64
`Reason` UInt32
`Result` UInt32
`Http3ClientConnectionId` UInt64
`Aborted` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebIO",
    "guid": "{50B3E73C-9370-461D-BB9F-26F32D68887D}",
    "event_source_name": "",
    "event_id": 204,
    "version": 0,
    "level": 4,
    "task": 419,
    "opcode": 0,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:01:52.944+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{EB64A0B3-7FFC-0000-D588-CD01FC2D780D}"
    },
    "execution": {
      "process_id": 11772,
      "thread_id": 13132
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Endpoint": "0x23E900EFC70",
    "Reason": 8,
    "Result": 0,
    "Socket": 1756
  },
  "message": "Task.ConnectionSocketClose"
}

Event ID 205: DnsQuery: Name Resolution Request (Name HostName) (Timeout Timeout) (CompletionContext: CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionNameResolutionRequest
Opcode: Start

Description

DnsQuery: Name Resolution Request (Name HostName) (Timeout Timeout) (CompletionContext: CompletionContext).

Message #

%1: Name Resolution Request (Name %2) (Timeout %3) (CompletionContext: %4)

Fields #

Name	Description
`DnsQuery` Pointer
`HostName` UnicodeString
`Timeout` UInt32
`CompletionContext` UInt64

Event ID 206: DnsQuery: Name Resolution Request Completed (FQDN FQDN) (Canonical CanonicalName) (AddressCount: AddressCount) AddressData: SockAddr.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionNameResolutionRequest
Opcode: Stop

Description

DnsQuery: Name Resolution Request Completed (FQDN FQDN) (Canonical CanonicalName) (AddressCount: AddressCount) AddressData: SockAddr.

Message #

%1: Name Resolution Request Completed (FQDN %2) (Canonical %3) (AddressCount: %4) AddressData: %6

Fields #

Name	Description
`DnsQuery` Pointer
`FQDN` UnicodeString
`CanonicalName` UnicodeString
`AddressCount` UInt32
`SockaddrLength` UInt32
`SockAddr` Binary

Event ID 207: DnsQuery: Name Resolution Request Failed (Error Error).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionNameResolutionRequest
Opcode: Stop

Description

DnsQuery: Name Resolution Request Failed (Error Error).

Message #

%1: Name Resolution Request Failed (Error %2)

Fields #

Name	Description
`DnsQuery` Pointer
`Error` UInt32

Event ID 208: DnsQuery: Name Resolution Request queued to CacheEntry.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionNameResolutionRequest

Description

DnsQuery: Name Resolution Request queued to CacheEntry.

Message #

%1: Name Resolution Request queued to %2

Fields #

Name	Description
`DnsQuery` Pointer
`CacheEntry` Pointer

Event ID 209: ReferenceContext: Name Resolution Request is cancelled.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionNameResolutionRequest

Description

ReferenceContext: Name Resolution Request is cancelled.

Message #

%1: Name Resolution Request is cancelled

Fields #

Name	Description
`ReferenceContext` Pointer

Event ID 210: ReferenceContext: Name Resolution Request Timed-out.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionNameResolutionRequest

Description

ReferenceContext: Name Resolution Request Timed-out.

Message #

%1: Name Resolution Request Timed-out

Fields #

Name	Description
`ReferenceContext` Pointer

Event ID 211: CacheEntry: Resolving addresses (Host ResolveName) (Flags: Flags).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionNameResolution
Opcode: Start

Description

CacheEntry: Resolving addresses (Host ResolveName) (Flags: Flags).

Message #

%1: Resolving addresses (Host %2) (Flags: %3)

Fields #

Name	Description
`CacheEntry` Pointer
`ResolveName` UnicodeString
`Flags` UInt32
`Error` UInt32
`AddressCount` UInt32

Event ID 212: CacheEntry: Address resolution completed (Error = Error) (Host ResolveName) (Flags: Flags).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionNameResolution
Opcode: Stop

Description

CacheEntry: Address resolution completed (Error = Error) (Host ResolveName) (Flags: Flags).(AddressCount AddressCount).

Message #

%1: Address resolution completed (Error = %4) (Host %2) (Flags: %3).(AddressCount %5)

Fields #

Name	Description
`CacheEntry` Pointer
`ResolveName` UnicodeString
`Flags` UInt32
`Error` UInt32
`AddressCount` UInt32

Event ID 213: Connection: Winsock Send Entity Start(DataChunks DataChunks) (Socket SocketHandle) (Buffers Buffer) (Context Context).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionSocketSend
Opcode: Start

Description

Connection: Winsock Send Entity Start(DataChunks DataChunks) (Socket SocketHandle) (Buffers Buffer) (Context Context).

Message #

%1: Winsock Send Entity Start(DataChunks %2) (Socket %3) (Buffers %4) (Context %5)

Fields #

Name	Description
`Connection` Pointer
`DataChunks` Pointer
`SocketHandle` UInt64
`Buffer` Pointer
`Context` Pointer
`Error` UInt32
`Information` UInt64
`Http3ClientStreamId` UInt64
`BufferLength` UInt64
`IsEof` Boolean
`IsHeaderPairs` Boolean

Event ID 214: Connection: Winsock Send Entity Complete (Error Error) (Information Information) (Socket SocketHandle) (Buffers Buffer) (Context Context).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionSocketSend
Opcode: Stop

Description

Connection: Winsock Send Entity Complete (Error Error) (Information Information) (Socket SocketHandle) (Buffers Buffer) (Context Context).

Message #

%1: Winsock Send Entity Complete (Error %6) (Information %7) (Socket %3) (Buffers %4) (Context %5)

Fields #

Name	Description
`Connection` Pointer
`DataChunks` Pointer
`SocketHandle` UInt64
`Buffer` Pointer
`Context` Pointer
`Error` UInt32
`Information` UInt64
`Http3ClientStreamId` UInt64
`BufferLength` UInt64
`IsEof` Boolean
`IsHeaderPairs` Boolean

Event ID 215: Connection: Winsock Recv Entity Start (DataChunks DataChunks) (Socket SocketHandle) (Buffers Buffer) (Context Context).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ConnectionSocketReceive
Opcode: Start

Description

Connection: Winsock Recv Entity Start (DataChunks DataChunks) (Socket SocketHandle) (Buffers Buffer) (Context Context).

Message #

%1: Winsock Recv Entity Start (DataChunks %2) (Socket %3) (Buffers %4) (Context %5)

Fields #

Name	Description
`Connection` Pointer
`DataChunks` Pointer
`SocketHandle` UInt64
`Buffer` Pointer
`Context` Pointer
`Error` UInt32
`Information` UInt64
`Http3ClientStreamId` UInt64
`BufferLength` UInt64
`IsEof` Boolean
`IsHeaderPairs` Boolean

Event ID 216: Connection: Winsock Recv Entity Complete(Error Error) (Information Information) (Socket SocketHandle) (Buffers Buffer) (Context Context).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ConnectionSocketReceive
Opcode: Stop

Description

Connection: Winsock Recv Entity Complete(Error Error) (Information Information) (Socket SocketHandle) (Buffers Buffer) (Context Context).

Message #

%1: Winsock Recv Entity Complete(Error %6) (Information %7) (Socket %3) (Buffers %4) (Context %5)

Fields #

Name	Description
`Connection` Pointer
`DataChunks` Pointer
`SocketHandle` UInt64
`Buffer` Pointer
`Context` Pointer
`Error` UInt32
`Information` UInt64
`Http3ClientStreamId` UInt64
`BufferLength` UInt64
`IsEof` Boolean
`IsHeaderPairs` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebIO",
    "guid": "{50B3E73C-9370-461D-BB9F-26F32D68887D}",
    "event_source_name": "",
    "event_id": 216,
    "version": 0,
    "level": 4,
    "task": 423,
    "opcode": 2,
    "keywords": "0x0000000200000000",
    "time_created": "2026-06-02T04:01:52.944+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{30000002-0007-FE00-80D9-0A91FC2DA028}"
    },
    "execution": {
      "process_id": 11772,
      "thread_id": 3448
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Buffer": "0x23E9009FB00",
    "Connection": "0x23E900EFC70",
    "Context": "0x23E9009F9B0",
    "DataChunks": "0x0",
    "Error": 995,
    "Information": 0,
    "SocketHandle": 18446744073709551615
  },
  "message": "Task.ConnectionSocketReceive"
}

Event ID 217: Connection: (H/3 Connection ID Http3ClientConnectionId) Got Stream (Stream Connection StreamConnection) (H/3 Stream ID Http3ClientStreamId).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: Http3ConnectionGetStream

Description

Connection: (H/3 Connection ID Http3ClientConnectionId) Got Stream (Stream Connection StreamConnection) (H/3 Stream ID Http3ClientStreamId).

Message #

%1: (H/3 Connection ID %2) Got Stream (Stream Connection %3) (H/3 Stream ID %4)

Fields #

Name	Description
`Connection` Pointer
`Http3ClientConnectionId` UInt64
`StreamConnection` Pointer
`Http3ClientStreamId` UInt64

Event ID 218: Connection: Read Stream Data Indicated (StreamId StreamId) (Size Size) (Headers Headers).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: StreamDataIndicated

Description

Connection: Read Stream Data Indicated (StreamId StreamId) (Size Size) (Headers Headers).

Message #

%1: Read Stream Data Indicated (StreamId %2) (Size %3) (Headers %4)

Fields #

Name	Description
`Connection` Pointer
`StreamId` UInt32
`Size` UInt32
`Headers` Boolean

Event ID 219: Connection: Stream Created (StreamId StreamId).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: StreamCreated

Description

Connection: Stream Created (StreamId StreamId).

Message #

%1: Stream Created (StreamId %2)

Fields #

Name	Description
`Connection` Pointer
`StreamId` UInt32

Event ID 220: Connection: Stream Aborted (StreamId StreamId) (HRESULT error Error) (Reset Code ResetCode).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: StreamAborted

Description

Connection: Stream Aborted (StreamId StreamId) (HRESULT error Error) (Reset Code ResetCode).

Message #

%1: Stream Aborted (StreamId %2) (HRESULT error %3) (Reset Code %4)

Fields #

Name	Description
`Connection` Pointer
`StreamId` UInt32
`Error` Int32
`ResetCode` UInt32

Event ID 221: Connection: Processing Initial HTTP/2 Setting (Id SettingId) (Value SettingValue).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProcessSettingsFrame

Description

Connection: Processing Initial HTTP/2 Setting (Id SettingId) (Value SettingValue).

Message #

%1: Processing Initial HTTP/2 Setting (Id %2) (Value %3)

Fields #

Name	Description
`Connection` Pointer
`SettingId` UInt16
`SettingValue` UInt32

Event ID 222: Connection: Received WINDOW_UPDATE frame (StreamId StreamId) (WindowIncrement WindowIncrement) (IsSession IsSession).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RecvWindowUpdateFrame

Description

Connection: Received WINDOW_UPDATE frame (StreamId StreamId) (WindowIncrement WindowIncrement) (IsSession IsSession).

Message #

%1: Received WINDOW_UPDATE frame (StreamId %2) (WindowIncrement %3) (IsSession %4)

Fields #

Name	Description
`Connection` Pointer
`StreamId` UInt32
`WindowIncrement` UInt32
`IsSession` Boolean

Event ID 223: Connection: Received GOAWAY frame (LastStreamId LastStreamId) (Error Error).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RecvGoawayFrame

Description

Connection: Received GOAWAY frame (LastStreamId LastStreamId) (Error Error).

Message #

%1: Received GOAWAY frame (LastStreamId %2) (Error %3)

Fields #

Name	Description
`Connection` Pointer
`LastStreamId` UInt32
`Error` UInt32

Event ID 224: Connection: HTTP/2 Connection Aborted (Error Error).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: Http2ConnectionAborted

Description

Connection: HTTP/2 Connection Aborted (Error Error).

Message #

%1: HTTP/2 Connection Aborted (Error %2)

Fields #

Name	Description
`Connection` Pointer
`Error` Int32

Event ID 225: Connection: HTTP/2 send window reached flow-control limit (StreamId StreamId) (IsSession IsSession).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: Http2WindowStalled

Description

Connection: HTTP/2 send window reached flow-control limit (StreamId StreamId) (IsSession IsSession).

Message #

%1: HTTP/2 send window reached flow-control limit (StreamId %2) (IsSession %3)

Fields #

Name	Description
`Connection` Pointer
`StreamId` UInt32
`IsSession` Boolean

Event ID 700: Connection: InitializeSecurityContext - Credential Handle(SecurityHandleHigh:SecurityHandleLow) Context Handle (CredHandleHigh:CredHandleLow) (Hostname HostName) (InputFlags InputFlags) (Buffer Buf...

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLInitializeSecurityContext
Opcode: Start

Description

Connection: InitializeSecurityContext - Credential Handle(SecurityHandleHigh:SecurityHandleLow) Context Handle (CredHandleHigh:CredHandleLow) (Hostname HostName) (InputFlags InputFlags) (Buffer Buffer [BufferLengthData/BufferLengthRemaining]).

Message #

%1: InitializeSecurityContext - Credential Handle(%2:%3) Context Handle (%4:%5) (Hostname %6) (InputFlags %7) (Buffer %8 [%9/%10])

Fields #

Name	Description
`Connection` Pointer
`SecurityHandleHigh` UInt64
`SecurityHandleLow` UInt64
`CredHandleHigh` UInt64
`CredHandleLow` UInt64
`HostName` UnicodeString
`InputFlags` UInt32
`Buffer` Pointer
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`OutputFlags` UInt32
`DataChunks` Pointer
`DataChunkBufferLength` UInt32
`Result` UInt32

Event ID 703: Connection: InitializeSecurityContext returned - (Result) Credential Handle(SecurityHandleHigh:SecurityHandleLow) Context Handle (CredHandleHigh:CredHandleLow) (OutputFlags OutputFlags) (Buffer Buf...

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLInitializeSecurityContext
Opcode: Stop

Description

Connection: InitializeSecurityContext returned - (Result) Credential Handle(SecurityHandleHigh:SecurityHandleLow) Context Handle (CredHandleHigh:CredHandleLow) (OutputFlags OutputFlags) (Buffer Buffer [BufferLengthData/BufferLengthRemaining]) (DataChunk DataChunks [DataChunkBufferLength]).

Message #

%1: InitializeSecurityContext returned - (%14) Credential Handle(%2:%3) Context Handle (%4:%5) (OutputFlags %11) (Buffer %8 [%9/%10]) (DataChunk %12 [%13])

Fields #

Name	Description
`Connection` Pointer
`SecurityHandleHigh` UInt64
`SecurityHandleLow` UInt64
`CredHandleHigh` UInt64
`CredHandleLow` UInt64
`HostName` UnicodeString
`InputFlags` UInt32
`Buffer` Pointer
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`OutputFlags` UInt32
`DataChunks` Pointer
`DataChunkBufferLength` UInt32
`Result` UInt32

Event ID 704: Connection: InitializeSecurityContext Details (Pre) - Credential Handle(SecurityHandleHigh:SecurityHandleLow) (Buffer Buffer [BufferLengthData/BufferLengthRemaining]) Data: Data.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLInitializeSecurityContext

Description

Connection: InitializeSecurityContext Details (Pre) - Credential Handle(SecurityHandleHigh:SecurityHandleLow) (Buffer Buffer [BufferLengthData/BufferLengthRemaining]) Data: Data.

Message #

%1: InitializeSecurityContext Details (Pre) - Credential Handle(%2:%3) (Buffer %4 [%5/%6]) Data: %7

Fields #

Name	Description
`Connection` Pointer
`SecurityHandleHigh` UInt64
`SecurityHandleLow` UInt64
`Buffer` Pointer
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`Data` Binary

Event ID 705: Connection: InitializeSecurityContext Details (Post) - Credential Handle(SecurityHandleHigh:SecurityHandleLow) (DataChunk DataChunks [DataChunkBufferLength]) Data: Data.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLInitializeSecurityContext

Description

Connection: InitializeSecurityContext Details (Post) - Credential Handle(SecurityHandleHigh:SecurityHandleLow) (DataChunk DataChunks [DataChunkBufferLength]) Data: Data.

Message #

%1: InitializeSecurityContext Details (Post) - Credential Handle(%2:%3) (DataChunk %4 [%5]) Data: %6

Fields #

Name	Description
`Connection` Pointer
`SecurityHandleHigh` UInt64
`SecurityHandleLow` UInt64
`DataChunks` Pointer
`DataChunkBufferLength` UInt32
`Data` Binary

Event ID 706: Connection: SSL Encryption (SSLIOContext SslIOContext) Context Handle(CredHandleHigh:CredHandleLow) (DataChunks: DataChunks) (Index: Index) (OutBuffer: Buffer[Length]) (Flags Flags).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLEncryptMessage
Opcode: Start

Description

Connection: SSL Encryption (SSLIOContext SslIOContext) Context Handle(CredHandleHigh:CredHandleLow) (DataChunks: DataChunks) (Index: Index) (OutBuffer: Buffer[Length]) (Flags Flags).

Message #

%1: SSL Encryption (SSLIOContext %2) Context Handle(%3:%4) (DataChunks: %5) (Index: %6) (OutBuffer: %7[%8]) (Flags %9)

Fields #

Name	Description
`Connection` Pointer
`SslIOContext` Pointer
`CredHandleHigh` UInt64
`CredHandleLow` UInt64
`DataChunks` Pointer
`Index` UInt32
`Buffer` Pointer
`Length` UInt64
`Flags` UInt32
`Error` UInt32

Event ID 707: Connection: SSL Encryption Complete (SSLIOContext SslIOContext) (ErrorCode: Error) Context Handle(CredHandleHigh:CredHandleLow) (DataChunks: DataChunks) (Index: Index) (InBuffer: Buffer[Length]) (F...

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLEncryptMessage
Opcode: Stop

Description

Connection: SSL Encryption Complete (SSLIOContext SslIOContext) (ErrorCode: Error) Context Handle(CredHandleHigh:CredHandleLow) (DataChunks: DataChunks) (Index: Index) (InBuffer: Buffer[Length]) (Flags Flags).

Message #

%1: SSL Encryption Complete (SSLIOContext %2) (ErrorCode: %10) Context Handle(%3:%4) (DataChunks: %5) (Index: %6) (InBuffer: %7[%8]) (Flags %9)

Fields #

Name	Description
`Connection` Pointer
`SslIOContext` Pointer
`CredHandleHigh` UInt64
`CredHandleLow` UInt64
`DataChunks` Pointer
`Index` UInt32
`Buffer` Pointer
`Length` UInt64
`Flags` UInt32
`Error` UInt32

Event ID 708: Connection: SSL Encryption Failed (SSLIOContext SslIOContext) (ErrorCode: Error) Context Handle(CredHandleHigh:CredHandleLow) (DataChunks: DataChunks) (Index: Index) (Flags Flags).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLEncryptMessage
Opcode: Stop

Description

Connection: SSL Encryption Failed (SSLIOContext SslIOContext) (ErrorCode: Error) Context Handle(CredHandleHigh:CredHandleLow) (DataChunks: DataChunks) (Index: Index) (Flags Flags).

Message #

%1: SSL Encryption Failed (SSLIOContext %2) (ErrorCode: %10) Context Handle(%3:%4) (DataChunks: %5) (Index: %6) (Flags %9)

Fields #

Name	Description
`Connection` Pointer
`SslIOContext` Pointer
`CredHandleHigh` UInt64
`CredHandleLow` UInt64
`DataChunks` Pointer
`Index` UInt32
`Buffer` Pointer
`Length` UInt64
`Flags` UInt32
`Error` UInt32

Event ID 709: Connection: SSL Encryption Details (SSLIOContext SslIOContext) Context Handle(CredHandleHigh:CredHandleLow) (DataChunks: DataChunks) (Index: Index) (OutBuffer: Buffer[Length]) (Flags Flags) Data:Data.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLEncryptMessage

Description

Connection: SSL Encryption Details (SSLIOContext SslIOContext) Context Handle(CredHandleHigh:CredHandleLow) (DataChunks: DataChunks) (Index: Index) (OutBuffer: Buffer[Length]) (Flags Flags) Data:Data.

Message #

%1: SSL Encryption Details (SSLIOContext %2) Context Handle(%3:%4) (DataChunks: %5) (Index: %6) (OutBuffer: %7[%8]) (Flags %9) Data:%10

Fields #

Name	Description
`Connection` Pointer
`SslIOContext` Pointer
`CredHandleHigh` UInt64
`CredHandleLow` UInt64
`DataChunks` Pointer
`Index` UInt32
`Buffer` Pointer
`Length` UInt32
`Flags` UInt32
`Data` Binary

Event ID 710: Connection: SSL Queue Send Entity (SSLIOContext SslIOContext) (DataChunks: DataChunks).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLSendEntity
Opcode: Start

Description

Connection: SSL Queue Send Entity (SSLIOContext SslIOContext) (DataChunks: DataChunks) (RequestDisconnect? RequestDisconnect).

Message #

%1: SSL Queue Send Entity (SSLIOContext %2) (DataChunks: %3) (RequestDisconnect? %4)

Fields #

Name	Description
`Connection` Pointer
`SslIOContext` Pointer
`DataChunks` Pointer
`RequestDisconnect` Boolean
`Error` UInt32

Event ID 711: Connection: SSL Send Entity Complete (SSLIOContext: SslIOContext) (Error: Error) (DataChunks: DataChunks).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLSendEntity
Opcode: Stop

Description

Connection: SSL Send Entity Complete (SSLIOContext: SslIOContext) (Error: Error) (DataChunks: DataChunks) (RequestDisconnect? RequestDisconnect).

Message #

%1: SSL Send Entity Complete (SSLIOContext: %2) (Error: %5) (DataChunks: %3) (RequestDisconnect? %4)

Fields #

Name	Description
`Connection` Pointer
`SslIOContext` Pointer
`DataChunks` Pointer
`RequestDisconnect` Boolean
`Error` UInt32

Event ID 712: Connection: SSL Cert Validation - (Error: Error) Context Handle(ContextHandleHigh:ContextHandleLow) (IgnoredServerCertErrors IgnoredServerCertErrors) (CertErrors ServerCertErrors).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLCertValidation
Opcode: Stop

Description

Connection: SSL Cert Validation - (Error: Error) Context Handle(ContextHandleHigh:ContextHandleLow) (IgnoredServerCertErrors IgnoredServerCertErrors) (CertErrors ServerCertErrors).

Message #

%1: SSL Cert Validation - (Error: %6) Context Handle(%2:%3) (IgnoredServerCertErrors %4) (CertErrors %5)

Fields #

Name	Description
`Connection` Pointer
`ContextHandleHigh` UInt64
`ContextHandleLow` UInt64
`IgnoredServerCertErrors` UInt32
`ServerCertErrors` UInt32
`Error` UInt32
`Reason` UInt32

Event ID 713: Connection: SSL Cert Validation Failure - Reason (Error: Error) Context Handle(ContextHandleHigh:ContextHandleLow) (IgnoredServerCertErrors IgnoredServerCertErrors) (CertErrors ServerCertErrors).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLCertValidation
Opcode: Stop

Description

Connection: SSL Cert Validation Failure - Reason (Error: Error) Context Handle(ContextHandleHigh:ContextHandleLow) (IgnoredServerCertErrors IgnoredServerCertErrors) (CertErrors ServerCertErrors).

Message #

%1: SSL Cert Validation Failure - %7 (Error: %6) Context Handle(%2:%3) (IgnoredServerCertErrors %4) (CertErrors %5)

Fields #

Name	Description
`Connection` Pointer
`ContextHandleHigh` UInt64
`ContextHandleLow` UInt64
`IgnoredServerCertErrors` UInt32
`ServerCertErrors` UInt32
`Error` UInt32
`Reason` UInt32

Event ID 720: Connection: SSL Queue Recv Entity Data Chunk (SSLIOContext SslIOContext) (DataChunks: DataChunks).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLReceiveEntity
Opcode: Start

Description

Connection: SSL Queue Recv Entity Data Chunk (SSLIOContext SslIOContext) (DataChunks: DataChunks).

Message #

%1: SSL Queue Recv Entity Data Chunk (SSLIOContext %2) (DataChunks: %3)

Fields #

Name	Description
`Connection` Pointer
`SslIOContext` Pointer
`DataChunks` Pointer

Event ID 721: Connection: SSL Filling Up Recv Entity Data Chunk (SSLIOContext: SslIOContext) (DataChunks: DataChunks) (PlainData PlainData[PlainDataLength]) (Information: Information).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLReceiveEntity
Opcode: Stop

Description

Connection: SSL Filling Up Recv Entity Data Chunk (SSLIOContext: SslIOContext) (DataChunks: DataChunks) (PlainData PlainData[PlainDataLength]) (Information: Information).

Message #

%1: SSL Filling Up Recv Entity Data Chunk (SSLIOContext: %2) (DataChunks: %3) (PlainData %4[%5]) (Information: %6)

Fields #

Name	Description
`Connection` Pointer
`SslIOContext` Pointer
`DataChunks` Pointer
`PlainData` Pointer
`PlainDataLength` UInt32
`Information` UInt32
`Error` UInt32

Event ID 722: Connection: SSL Decryption - Context Handle(ContextHandleHigh:ContextHandleLow) (Buffer Buffer[BufferLengthData/BufferLengthRemaining]) (PlainData PlainData[PlainDataLength]).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLDecryptMessage
Opcode: Start

Description

Connection: SSL Decryption - Context Handle(ContextHandleHigh:ContextHandleLow) (Buffer Buffer[BufferLengthData/BufferLengthRemaining]) (PlainData PlainData[PlainDataLength]).

Message #

%1: SSL Decryption - Context Handle(%2:%3) (Buffer %4[%5/%6]) (PlainData %7[%8])

Fields #

Name	Description
`Connection` Pointer
`ContextHandleHigh` UInt64
`ContextHandleLow` UInt64
`Buffer` Pointer
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`PlainData` Pointer
`PlainDataLength` UInt32
`SecStatus` UInt32
`Error` UInt32

Event ID 723: Connection: SSL Decryption Complete (SecStatus SecStatus) (Error Error) Context Handle(ContextHandleHigh:ContextHandleLow) (Buffer Buffer[BufferLengthData/BufferLengthRemaining]) (PlainData PlainDa...

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLDecryptMessage
Opcode: Stop

Description

Connection: SSL Decryption Complete (SecStatus SecStatus) (Error Error) Context Handle(ContextHandleHigh:ContextHandleLow) (Buffer Buffer[BufferLengthData/BufferLengthRemaining]) (PlainData PlainData[PlainDataLength]).

Message #

%1: SSL Decryption Complete (SecStatus %9) (Error %10) Context Handle(%2:%3) (Buffer %4[%5/%6]) (PlainData %7[%8])

Fields #

Name	Description
`Connection` Pointer
`ContextHandleHigh` UInt64
`ContextHandleLow` UInt64
`Buffer` Pointer
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`PlainData` Pointer
`PlainDataLength` UInt32
`SecStatus` UInt32
`Error` UInt32

Event ID 724: Connection: SSL Receive Buffer Posting Receive (DataChunk DataChunks) (Buffer Buffer[Consumed/Available]).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLConnectionBufferReceive
Opcode: Start

Description

Connection: SSL Receive Buffer Posting Receive (DataChunk DataChunks) (Buffer Buffer[Consumed/Available]).

Message #

%1: SSL Receive Buffer Posting Receive (DataChunk %2) (Buffer %3[%4/%5])

Fields #

Name	Description
`Connection` Pointer
`DataChunks` Pointer
`Buffer` Pointer
`Consumed` UInt32
`Available` UInt32
`Information` UInt32
`Error` UInt32

Event ID 725: Connection: SSL Receive Buffer Receive Complete (DataChunk DataChunks) (Error Error) (Information Information) (Buffer Buffer[Consumed/Available]).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: SSLConnectionBufferReceive
Opcode: Stop

Description

Connection: SSL Receive Buffer Receive Complete (DataChunk DataChunks) (Error Error) (Information Information) (Buffer Buffer[Consumed/Available]).

Message #

%1: SSL Receive Buffer Receive Complete (DataChunk %2) (Error %7) (Information %6) (Buffer %3[%4/%5])

Fields #

Name	Description
`Connection` Pointer
`DataChunks` Pointer
`Buffer` Pointer
`Consumed` UInt32
`Available` UInt32
`Information` UInt32
`Error` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebIO",
    "guid": "{50B3E73C-9370-461D-BB9F-26F32D68887D}",
    "event_source_name": "",
    "event_id": 725,
    "version": 0,
    "level": 5,
    "task": 430,
    "opcode": 2,
    "keywords": "0x0000000200000000",
    "time_created": "2026-06-02T04:01:52.944+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{30000002-0007-FE00-80D9-0A91FC2DA028}"
    },
    "execution": {
      "process_id": 11772,
      "thread_id": 3448
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Available": 16384,
    "Buffer": "0x23E9106FE40",
    "Connection": "0x23E900EFC70",
    "Consumed": 0,
    "DataChunks": "0x23E900F06E0",
    "Error": 995,
    "Information": 0
  },
  "message": "Task.SSLConnectionBufferReceive"
}

Event ID 726: Connection: SSL Receive Buffer Details: (Buffer Buffer[BufferLengthData/BufferLengthRemaining]) Data: Data.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLConnectionBufferReceive

Description

Connection: SSL Receive Buffer Details: (Buffer Buffer[BufferLengthData/BufferLengthRemaining]) Data: Data.

Message #

%1: SSL Receive Buffer Details: (Buffer %2[%3/%4]) Data: %5

Fields #

Name	Description
`Connection` Pointer
`Buffer` Pointer
`BufferLengthData` UInt32
`BufferLengthRemaining` UInt32
`Data` Binary
`DummyWorkaroundVal` Boolean

Event ID 727: Connection: SSL Receive Buffer Posting Receive (Buffer OldBuffer) (NewBuffer: NewBuffer).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLConnectionBufferReceive
Opcode: Reallocate

Description

Connection: SSL Receive Buffer Posting Receive (Buffer OldBuffer) (NewBuffer: NewBuffer).

Message #

%1: SSL Receive Buffer Posting Receive (Buffer %2) (NewBuffer: %3)

Fields #

Name	Description
`Connection` Pointer
`OldBuffer` Pointer
`NewBuffer` Pointer

Event ID 728: Connection: SSL AcquireCredentialsHandle - (EnabledProtocols EnabledProtocols) (ClientCert SSLClientCert) (EnableRevertToSelfClientCertificate EnableRevertToSelfClientCertificate).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLAcquireCredentialsHandle
Opcode: Start

Description

Connection: SSL AcquireCredentialsHandle - (EnabledProtocols EnabledProtocols) (ClientCert SSLClientCert) (EnableRevertToSelfClientCertificate EnableRevertToSelfClientCertificate).

Message #

%1: SSL AcquireCredentialsHandle - (EnabledProtocols %2) (ClientCert %3) (EnableRevertToSelfClientCertificate %4)

Fields #

Name	Description
`Connection` Pointer
`EnabledProtocols` UInt32
`SSLClientCert` Pointer
`EnableRevertToSelfClientCertificate` UInt16
`CipherConfig` UInt32
`CredHandleHigh` UInt64
`CredHandleLow` UInt64
`Result` UInt32

Event ID 729: Connection: SSL AcquireCredentialsHandle returned - (CredHandleLow) Credential Handle(CipherConfig:CredHandleHigh) (EnabledProtocols EnabledProtocols) (ClientCert SSLClientCert).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLAcquireCredentialsHandle
Opcode: Stop

Description

Connection: SSL AcquireCredentialsHandle returned - (CredHandleLow) Credential Handle(CipherConfig:CredHandleHigh) (EnabledProtocols EnabledProtocols) (ClientCert SSLClientCert) (EnableRevertToSelfClientCertificate EnableRevertToSelfClientCertificate).

Message #

%1: SSL AcquireCredentialsHandle returned - (%7) Credential Handle(%5:%6) (EnabledProtocols %2) (ClientCert %3) (EnableRevertToSelfClientCertificate %4)

Fields #

Name	Description
`Connection` Pointer
`EnabledProtocols` UInt32
`SSLClientCert` Pointer
`EnableRevertToSelfClientCertificate` UInt16
`CipherConfig` UInt32
`CredHandleHigh` UInt64
`CredHandleLow` UInt64
`Result` UInt32

Event ID 730: Connection: SSL AcquireCredentialsHandle failed - (CredHandleLow) (EnabledProtocols EnabledProtocols) (ClientCert SSLClientCert) (EnableRevertToSelfClientCertificate EnableRevertToSelfClientCertifi...

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: SSLAcquireCredentialsHandle
Opcode: Stop

Description

Connection: SSL AcquireCredentialsHandle failed - (CredHandleLow) (EnabledProtocols EnabledProtocols) (ClientCert SSLClientCert) (EnableRevertToSelfClientCertificate EnableRevertToSelfClientCertificate).

Message #

%1: SSL AcquireCredentialsHandle failed - (%7) (EnabledProtocols %2) (ClientCert %3) (EnableRevertToSelfClientCertificate %4)

Fields #

Name	Description
`Connection` Pointer
`EnabledProtocols` UInt32
`SSLClientCert` Pointer
`EnableRevertToSelfClientCertificate` UInt16
`CipherConfig` UInt32
`CredHandleHigh` UInt64
`CredHandleLow` UInt64
`Result` UInt32

Event ID 731: Failed to create HTTP/3 API session due to TLS 1.

Provider: Microsoft-Windows-WebIO
Channel: Operational
Task: QuicTls13Disabled
Opcode: Stop

Description

Failed to create HTTP/3 API session due to TLS 1.3 disabled - Error Error.

Message #

Failed to create HTTP/3 API session due to TLS 1.3 disabled - Error %1

Fields #

Name	Description
`Error` Int32

Event ID 900: ProtocolObject: WebCompleteProtocolUpgrade completed successfully.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: CompleteProtocolUpgrade

Description

ProtocolObject: WebCompleteProtocolUpgrade completed successfully. (Handle ProtocolHandle) (Request Request[RequestHandle]) (Session Session[SessionHandle]).

Message #

%1: WebCompleteProtocolUpgrade completed successfully. (Handle %2) (Request %3[%4]) (Session %5[%6])

Fields #

Name	Description
`ProtocolObject` Pointer
`ProtocolHandle` UInt64
`Request` Pointer
`RequestHandle` UInt64
`Session` Pointer
`SessionHandle` UInt64
`Error` UInt32

Event ID 901: ProtocolObject: WebCompleteProtocolUpgrade failed with error: Error.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: CompleteProtocolUpgrade

Description

ProtocolObject: WebCompleteProtocolUpgrade failed with error: Error. (Handle ProtocolHandle) (Request Request[RequestHandle]) (Session Session[SessionHandle]).

Message #

%1: WebCompleteProtocolUpgrade failed with error: %7. (Handle %2) (Request %3[%4]) (Session %5[%6])

Fields #

Name	Description
`ProtocolObject` Pointer
`ProtocolHandle` UInt64
`Request` Pointer
`RequestHandle` UInt64
`Session` Pointer
`SessionHandle` UInt64
`Error` UInt32

Event ID 902: Request: WebProtocolCancelHandle (Handle: RequestHandle).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolCancelHandle
Opcode: Start

Description

Request: WebProtocolCancelHandle (Handle: RequestHandle).

Message #

%1: WebProtocolCancelHandle (Handle: %2)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`Error` UInt32

Event ID 903: Request: WebProtocolCancelHandle Complete (Error: Flags) (Handle: RequestHandle).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolCancelHandle
Opcode: Stop

Description

Request: WebProtocolCancelHandle Complete (Error: Flags) (Handle: RequestHandle).

Message #

%1: WebProtocolCancelHandle Complete (Error: %3) (Handle: %2)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`Error` UInt32

Event ID 904: ApiObject: WebCloseProtocolHandle called (Handle ApiHandle).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: CloseProtocolHandle
Opcode: Start

Description

ApiObject: WebCloseProtocolHandle called (Handle ApiHandle).

Message #

%1: WebCloseProtocolHandle called (Handle %2)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 905: ApiObject: WebCloseProtocolHandle completed (Error Error) (Handle ApiHandle).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: CloseProtocolHandle
Opcode: Start

Description

ApiObject: WebCloseProtocolHandle completed (Error Error) (Handle ApiHandle).

Message #

%1: WebCloseProtocolHandle completed (Error %4) (Handle %2)

Fields #

Name	Description
`ApiObject` Pointer
`ApiHandle` UInt64
`Flags` UInt64
`Error` UInt32

Event ID 906: Request: Set Protocol Option Option (Handle RequestHandle) (Error Error) (Length Length) (Value Value).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolConfiguration
Opcode: Set

Description

Request: Set Protocol Option Option (Handle RequestHandle) (Error Error) (Length Length) (Value Value).

Message #

%1: Set Protocol Option %3 (Handle %2) (Error %6) (Length %4) (Value %5)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Option` UInt32
`Length` UInt32
`Value` Binary
`Error` UInt32

Event ID 907: Request: WebProtocolSendData (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolSendData
Opcode: Start

Description

Request: WebProtocolSendData (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebProtocolSendData (Handle: %2) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 908: Request: WebProtocolSendData Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolSendData
Opcode: Stop

Description

Request: WebProtocolSendData Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebProtocolSendData Inline Completion (Handle: %2) (Error: %7) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 909: ProtocolObject: Completing WebProtocolSendData (Handle: Handle) (Error: Context) CompletionContext (Error).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolSendDataCallback
Opcode: Start

Description

ProtocolObject: Completing WebProtocolSendData (Handle: Handle) (Error: Context) CompletionContext (Error).

Message #

%1: Completing WebProtocolSendData (Handle: %2) (Error: %3) CompletionContext (%4)

Fields #

Name	Description
`ProtocolObject` Pointer
`Handle` UInt64
`Context` Pointer
`Error` UInt32
`Information` UInt64

Event ID 910: ProtocolObject: Completing WebProtocolSendData Complete (Handle: Handle) (Error: Context) CompletionContext (Error).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolSendDataCallback
Opcode: Stop

Description

ProtocolObject: Completing WebProtocolSendData Complete (Handle: Handle) (Error: Context) CompletionContext (Error).

Message #

%1: Completing WebProtocolSendData Complete (Handle: %2) (Error: %3) CompletionContext (%4)

Fields #

Name	Description
`ProtocolObject` Pointer
`Handle` UInt64
`Context` Pointer
`Error` UInt32
`Information` UInt64

Event ID 911: Request: WebProtocolReceiveData (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolReceiveData
Opcode: Start

Description

Request: WebProtocolReceiveData (Handle: RequestHandle) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebProtocolReceiveData (Handle: %2) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 912: Request: WebProtocolReceiveData Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolReceiveData
Opcode: Stop

Description

Request: WebProtocolReceiveData Inline Completion (Handle: RequestHandle) (Error: Error) (Flags: Flags) (DataChunks DataChunks [DataChunkCount]) CompletionContext (CompletionContext).

Message #

%1: WebProtocolReceiveData Inline Completion (Handle: %2) (Error: %7) (Flags: %3) (DataChunks %4 [%5]) CompletionContext (%6)

Fields #

Name	Description
`Request` Pointer
`RequestHandle` UInt64
`Flags` UInt32
`DataChunks` Pointer
`DataChunkCount` UInt32
`CompletionContext` Pointer
`Error` UInt32

Event ID 913: ProtocolObject: Completing WebProtocolReceiveData (Handle: Handle) (Error: Context) CompletionContext (Error).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolReceiveDataCallback
Opcode: Start

Description

ProtocolObject: Completing WebProtocolReceiveData (Handle: Handle) (Error: Context) CompletionContext (Error).

Message #

%1: Completing WebProtocolReceiveData (Handle: %2) (Error: %3) CompletionContext (%4)

Fields #

Name	Description
`ProtocolObject` Pointer
`Handle` UInt64
`Context` Pointer
`Error` UInt32
`Information` UInt64

Event ID 914: ProtocolObject: Completing WebProtocolReceiveData Complete (Handle: Handle) (Error: Context) CompletionContext (Error).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ProtocolReceiveDataCallback
Opcode: Stop

Description

ProtocolObject: Completing WebProtocolReceiveData Complete (Handle: Handle) (Error: Context) CompletionContext (Error).

Message #

%1: Completing WebProtocolReceiveData Complete (Handle: %2) (Error: %3) CompletionContext (%4)

Fields #

Name	Description
`ProtocolObject` Pointer
`Handle` UInt64
`Context` Pointer
`Error` UInt32
`Information` UInt64

Event ID 2100: Context: =====Request Initialize===================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Request Initialize===================.

Message #

%1: =====Request Initialize===================

Fields #

Name	Description
`Context` Pointer

Event ID 2101: Context: =====Query Endpoints======================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Query Endpoints======================.

Message #

%1: =====Query Endpoints======================

Fields #

Name	Description
`Context` Pointer

Event ID 2102: Context: =====Waiting For Available Connection=====.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Waiting For Available Connection=====.

Message #

%1: =====Waiting For Available Connection=====

Fields #

Name	Description
`Context` Pointer

Event ID 2111: Context: =====Request Connect======================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Request Connect======================.

Message #

%1: =====Request Connect======================

Fields #

Name	Description
`Context` Pointer

Event ID 2112: Context: =====Name Resolution======================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Name Resolution======================.

Message #

%1: =====Name Resolution======================

Fields #

Name	Description
`Context` Pointer

Event ID 2113: Context: =====TCP Connect==========================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====TCP Connect==========================.

Message #

%1: =====TCP Connect==========================

Fields #

Name	Description
`Context` Pointer

Event ID 2114: Context: =====SSL Negotiation======================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====SSL Negotiation======================.

Message #

%1: =====SSL Negotiation======================

Fields #

Name	Description
`Context` Pointer

Event ID 2120: Context: =====Generate Headers=====================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Generate Headers=====================.

Message #

%1: =====Generate Headers=====================

Fields #

Name	Description
`Context` Pointer

Event ID 2121: Context: =====Send Headers=========================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Send Headers=========================.

Message #

%1: =====Send Headers=========================

Fields #

Name	Description
`Context` Pointer

Event ID 2122: Context: =====Send Entity==========================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Send Entity==========================.

Message #

%1: =====Send Entity==========================

Fields #

Name	Description
`Context` Pointer

Event ID 2123: Context: =====Send Complete========================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Send Complete========================.

Message #

%1: =====Send Complete========================

Fields #

Name	Description
`Context` Pointer

Event ID 2130: Context: =====Receive Headers======================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Receive Headers======================.

Message #

%1: =====Receive Headers======================

Fields #

Name	Description
`Context` Pointer

Event ID 2131: Context: =====Receive Entity=======================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Receive Entity=======================.

Message #

%1: =====Receive Entity=======================

Fields #

Name	Description
`Context` Pointer

Event ID 2132: Context: =====Receive Complete=====================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Receive Complete=====================.

Message #

%1: =====Receive Complete=====================

Fields #

Name	Description
`Context` Pointer

Event ID 2140: Context: =====Request Restart======================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Request Restart======================.

Message #

%1: =====Request Restart======================

Fields #

Name	Description
`Context` Pointer

Event ID 2141: Context: =====Request Done=========================.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: RequestState

Description

Context: =====Request Done=========================.

Message #

%1: =====Request Done=========================

Fields #

Name	Description
`Context` Pointer

Event ID 59992: Restore Thread Token Token (Error: Error).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ThreadToken
Opcode: Stop

Description

Restore Thread Token Token (Error: Error).

Message #

Restore Thread Token %1 (Error: %2)

Fields #

Name	Description
`Token` UInt64
`Error` UInt32

Event ID 59993: Set Thread Token Token (OldToken OldToken) (Error: Error).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ThreadToken
Opcode: Start

Description

Set Thread Token Token (OldToken OldToken) (Error: Error).

Message #

Set Thread Token %1 (OldToken %2) (Error: %3)

Fields #

Name	Description
`Token` UInt64
`OldToken` UInt64
`Error` UInt32

Event ID 59994: Get Thread Token Token (Error: Error) (SID: SID).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ThreadToken
Opcode: Get

Description

Get Thread Token Token (Error: Error) (SID: SID).

Message #

Get Thread Token %1 (Error: %3) (SID: %2)

Fields #

Name	Description
`Token` UInt64
`SID` SID
`Error` UInt32

Event ID 59995: Canceling EtwQueueActionType Thread Action (Context: Context).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ThreadAction
Opcode: Cancel

Description

Canceling EtwQueueActionType Thread Action (Context: Context).

Message #

Canceling %2 Thread Action (Context: %1)

Fields #

Name	Description
`Context` Pointer
`EtwQueueActionType` UInt32

Event ID 59996: Queue EtwQueueActionType Thread Action (Context: Context).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: ThreadAction
Opcode: Queue

Description

Queue EtwQueueActionType Thread Action (Context: Context).

Message #

Queue %2 Thread Action (Context: %1)

Fields #

Name	Description
`Context` Pointer
`EtwQueueActionType` UInt32

Event ID 59997: Stopping EtwQueueActionType Thread Action (Context: Context).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ThreadAction
Opcode: Stop

Description

Stopping EtwQueueActionType Thread Action (Context: Context).

Message #

Stopping %2 Thread Action (Context: %1)

Fields #

Name	Description
`Context` Pointer
`EtwQueueActionType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebIO",
    "guid": "{50B3E73C-9370-461D-BB9F-26F32D68887D}",
    "event_source_name": "",
    "event_id": 59997,
    "version": 0,
    "level": 5,
    "task": 433,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:01:52.944+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{30000002-0007-FE00-80D9-0A91FC2DA028}"
    },
    "execution": {
      "process_id": 11772,
      "thread_id": 3448
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Context": "0x23E9009F9B0",
    "EtwQueueActionType": 3
  },
  "message": "Task.ThreadAction"
}

Event ID 59998: Starting EtwQueueActionType Thread Action (Context: Context).

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ThreadAction
Opcode: Start

Description

Starting EtwQueueActionType Thread Action (Context: Context).

Message #

Starting %2 Thread Action (Context: %1)

Fields #

Name	Description
`Context` Pointer
`EtwQueueActionType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebIO",
    "guid": "{50B3E73C-9370-461D-BB9F-26F32D68887D}",
    "event_source_name": "",
    "event_id": 59998,
    "version": 0,
    "level": 5,
    "task": 433,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:01:52.944+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{30000002-0007-FE00-80D9-0A91FC2DA028}"
    },
    "execution": {
      "process_id": 11772,
      "thread_id": 3448
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Context": "0x23E9009F9B0",
    "EtwQueueActionType": 3
  },
  "message": "Task.ThreadAction"
}

Event ID 59999: Message.

Provider: Microsoft-Windows-WebIO
Channel: Diagnostic
Task: WebIODebug

Description

Message

Message #

%2

Fields #

Name	Description
`Length` UInt16
`Message` AnsiString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {50B3E73C-9370-461D-BB9F-26F32D68887D}

Defined in webio.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)